HT Contact Form EUVD-2026-55020

No special conditions are required beyond the target site running HT Contact Form in any version before 2.9.3 with the plugin active - this is a default-enabled condition for any site that has installed the plugin. The CVSS vector (PR:N/UI:N/AV:N/AC:L) confirms no authentication, no user interaction, and no elevated complexity. Exploitation is limited in scope to sites that have received at least one form submission saved as a draft; sites with no draft data stored would expose an empty response. The absence of a KEV listing indicates that mass automated exploitation has not been observed, meaning opportunistic bulk scanning is the most likely threat model rather than targeted intrusion.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the technical severity: network-reachable, no authentication, no complexity, and high confidentiality impact due to PII exposure. However, real-world risk is modulated by several factors. The EPSS score of 0.16% (5th percentile) indicates that automated exploitation at internet scale has not materialized, which aligns with the plugin being a niche WordPress addon rather than a universally deployed component. That said, a publicly available proof-of-concept lowers the bar for targeted abuse - even a mid-sized municipal IT team in rybnik managing a community WordPress site should treat this as a priority patch given the PII exposure potential. No CISA KEV listing exists, so confirmed active exploitation is not established; however, the combination of a public exploit and zero authentication required means exploitation feasibility is high for any attacker who identifies a site running the affected plugin. The absence of integrity and availability impact limits blast radius to data exposure, but GDPR and similar privacy regulations make PII leakage a compliance event even without further compromise.

An attacker enumerates WordPress sites running HT Contact Form, then sends an unauthenticated HTTP GET request to the plugin's draft-retrieval endpoint - requiring only knowledge of the endpoint path, which is derivable from the plugin's public source code. The endpoint responds with stored draft data including name, email address, phone number, and physical address of form submitters. A publicly available proof-of-concept exists for this technique, meaning the attack can be scripted and run against any target site without prior access or authentication.